The server was implanted with a Trojan horse, which was cleared and returned for three consecutive days.

However, this guy still has a little conscience. He comes every day to insert some data, and then tinkered with an asp Trojan horse on the website and added a piece of virus code.

The inspection found that there was a website on a server that was not strictly filtered and was injected by SQL.

This guy immediately increased the permissions of the website and added SQL code filtering.

Because when a general hacker attacks SQL Server, the first method used is to execute the master extended stored procedure xp_cmdshell command to destroy the database. Disable the corresponding SQL Server database xp_cmdShell immediately.

xp_cmdshell allows system administrators to execute a given command string in the form of an operating system command-line interpreter and return any output in a text line. It is a very powerful extended stored procedure.

Method:

Turn off xp_cmdshell Use Master EXEC sp_dropextendedproc N'xp_cmdshell' Go
Open xp_cmdshell Use Master EXEC sp_addextendedproc N'xp_cmdshell',
N'xplog70.dll' Go